1. Field of the Invention
This invention relates to a wireless local area network and, more particularly, to a secure wireless local area network.
2. Description of the Prior Art
A wireless local area network (LAN) is a flexible data communications system implemented as an extension to or as an alternative for a wired LAN. Using radio frequency (RF) technology, wireless LANs transmit and receive data over the air, minimizing the need for wired connections. Thus, wireless LANs combine data connectivity with operator mobility.
Wireless LANs have gained strong popularity in a number of vertical markets, including the health-care industry, retail, manufacture, warehousing, and academia. These industries have profited from the productivity gains of using hand-held terminals, personal digital assistants (PDAs), notebook computers, and the like to transmit real-time information to centralized hosts for processing. Today, wireless LANs are becoming more widely recognized as a general-purpose connectivity alternative for a broad range of business customers. With wireless LANs, operators can access shared information without looking for a place to plug in. Wireless LANs offer a variety of productivity, convenience, and cost advantages over traditional wired networks including mobility, installation speed, simplicity, and flexibility, reduced cost of ownership, and scalability. Wireless LANs frequently augment rather than replace wired LAN networks—often providing the final few meters of connectivity between a wired network and the mobile operator.
Wireless LANs use electromagnetic airwaves (radio or infrared) to communicate information from one point to another without relying on any physical connection. Radio waves are often referred to as radio carriers because they simply perform the function of delivering energy to a remote receiver. The data being transmitted is superimposed on the radio carrier so that it can be accurately extracted at the receiving end. This is generally referred to as modulation of the carrier by the information being transmitted. Once data is superimposed (modulated) onto the radio carrier, the radio signal occupies more than a single frequency since the frequency or bit rate of the modulating information adds to the carrier. To extract data, a radio receiver tunes in one radio frequency while rejecting all other frequencies.
FIG. 1 is a block diagram of a conventional network 10 including a wired LAN 12 and a wireless LAN 14. The wired LAN 12 is often set up as an Intranet. An Intranet is a network designed for information processing within a company or organization. An Intranet is so called because it usually employs Web pages for information dissemination and applications associated with the Internet, such as Web browsers. It can also include file transfer protocol (FTP) sites, e-mail, and newsgroups and mailing lists accessible only to those within the organization.
A typical wired LAN 12 includes a plurality of wired devices 16A–D, e.g., desktop personal computers (PCs), connected to the same or different sub-networks (subnets), e.g., 18, 20, and 22 terminating at a router (not shown). The wired devices 16A–D are physically connected to each other through cabling (not shown) on the wired LAN 12. For example, PCs 16A and 16B are connected to subnet 18 while PCs 16C and 16D are connected to subnet 20. Subnets 18 and 20 are coupled to each other and to inner firewall router 24 via subnet 22. The inner and outer firewall routers 24 and 28 provide an authorization mechanism that assures only specified operators or applications can gain access to the wired LAN 12. The inner firewall router 24 links the wired LAN 12 to remote users seeking access through the wireless LAN 14 and the Internet 30. The outer firewall 28 limits access to the Virtual Private Network (VPN) server 26 by remote users seeking access through the Internet 30.
A typical wireless LAN 14 includes at least one access point (AP), the physical cabling (not shown) that connects one AP to another, and at least one wireless device, like devices 34A–C. Common examples of wireless devices 34A–C are hand-held terminals, PDAs, notebook computers, and the like. Other wired and wireless devices are well known to those of skill in the art. An AP, like APs 32A–B, is a transmitter/receiver (transceiver) device that connects to the wireless LAN 14 from a fixed location. At a minimum, the AP receives, buffers, and transmits data between the wireless devices 34A–C and the wireless LAN 14 through an air communications channel. A single AP can support a single wireless device—e.g., AP 32A supports wireless device 34A—or a small group of wireless devices—e.g., AP 32B supports wireless devices 34B and 34C—. The APs can function within a range of less than one hundred to several hundred feet. The AP includes an antenna that is usually mounted high but may be mounted essentially anywhere that is practical so long as the desired radio coverage is obtained.
The inner firewall router 24 is coupled to the VPN tunnel server 26 and the outer firewall router 28. The VPN server 26 encrypts messages to and from the wired LAN 12 and may provide secondary authentication for remote users. The VPN server 26 uses the Internet 30 to economically connect remote users such as those in branch offices and remote project teams to the wired LAN 12. The VPN server 26 also acts as a gateway between operators of the wireless LAN 14 and the wired LAN 12. The VPN server 26 views access to the wired LAN 12 by the operators of the wireless devices 34A–C the same as remote access by remote users. Thus, a wireless device operator only has access to other wireless devices on the wireless LAN 14 but does not have automatic access to the Internet 30 or any of the wired devices 16A–D on the wired LAN 12.
To maximize security and prevent unauthorized access to the wired LAN 12 from a rogue wireless device or AP, the wireless LAN 14 is isolated from the wired LAN 12. Put differently, the cabling that physically connects one wired device to another on the wired LAN 12 is different from the cabling 36 that connects one AP to another on the wireless LAN 14. Isolating the wireless LAN 14 from the wired LAN 12 prevents a wireless device from accessing a wired LAN 12 unless authorized to do so by the VPN server 26 and the inner firewall router 24. However, isolating the wireless LAN 14 from the wired LAN 12 is costly and labor intensive. Moreover, routing the wireless and other remote user traffic through the single VPN server 26 slows access for both, particularly if large files are being transferred. As the VPN server 26 and the firewalls 24 and 28 are busy checking or re-routing data communications packets, they do not flow through the network 10 as efficiently as they would if the VPN server 26 and the firewalls 24 and 28 were not in place. Additionally, if the VPN server 26 fails, wired network 12 access through the VPN server 26 is prevented for both wireless operators and remote users.
Another disadvantage to the network 10 is that security is not well integrated. In order for wireless device operators to access the wired LAN 12, the VPN server 26 must authenticate them. This requires the wireless operator to install authentication software (not shown) on the wireless device. The authentication software supported by the VPN server 26 may change or be upgraded requiring the operator to change or upgrade the authentication software installed on his wireless device before the VPN server 26 will authorize access to the wired LAN 12. The high error rate in this type of configuration results in an increased cost of ownership.
Accordingly, a need remains for a secure wireless local area network that is inexpensive, easy to set up, fast, and reliable.